What is the CVSS score of CVE-2026-41280?

CVE-2026-41280 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache DolphinScheduler are affected by CVE-2026-41280?

Apache DolphinScheduler versions prior to 3.4.2 contain an authorization bypass in the API module allowing authenticated users to delete workflow task definitions from projects outside their assigned…. A patch is available.

How to fix or mitigate CVE-2026-41280?

Within 24 hours: Inventory all systems running Apache DolphinScheduler and determine versions (pre-3.4.2 indicates exposure). Within 7 days: Upgrade to DolphinScheduler 3.4.2 or later, or implement compensating controls if immediate upgrade is infeasible. Within 30 days: Conduct comprehensive access control audit across all DolphinScheduler projects and enforce least-privilege API restrictions limiting users to essential projects only.

Apache DolphinScheduler CVE-2026-41280

EUVD-2026-37581 MEDIUM

Incorrect Authorization (CWE-863)

2026-06-17

Apache Authentication Bypass

4.9

CVSS 3.1 · NVD

Severity by source

Vendor (CNA) PRIMARY

MEDIUM

qualitative

NVD

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible API requires a valid login (PR:L, AV:N); task deletion yields limited integrity and availability impact with no confidentiality loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 17, 2026 - 11:01 EUVD

Analysis Generated

Jun 17, 2026 - 02:17 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.apache.dolphinscheduler:dolphinscheduler-api (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.4.2.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Incorrect Authorization in Apache DolphinScheduler API - CVE-2026-41280 Jun 17, 2026

AnalysisAI

Incorrect Authorization in Apache DolphinScheduler's API module (versions prior to 3.4.2) allows any authenticated user holding basic system login privileges to delete task definitions belonging to projects outside their authorized scope. The flaw bypasses project-level access controls server-side, enabling cross-project destructive operations without requiring elevated roles. No public exploit has been identified at time of analysis, and no KEV listing exists; moderate severity reflects the authentication prerequisite and the impact being limited to data destruction rather than exfiltration or code execution.

Technical ContextAI

Apache DolphinScheduler is an open-source distributed workflow orchestration platform. The vulnerability resides specifically in the API module (Maven artifact org.apache.dolphinscheduler:dolphinscheduler-api) and represents an Incorrect Authorization flaw - likely CWE-863 (Incorrect Authorization) or CWE-284 (Improper Access Control). The platform enforces multi-tenant project isolation, where users are granted permissions scoped to specific projects. The defect causes the server-side handler for task definition deletion to omit or improperly evaluate project membership checks, allowing a user's authenticated session to issue deletion operations against task resources in any project, regardless of their assigned project-level role. No CWE identifier or CPE string was supplied in the available intelligence; the affected Maven coordinate org.apache.dolphinscheduler:dolphinscheduler-api is the canonical identifier.

RemediationAI

Upgrade Apache DolphinScheduler to version 3.4.2 or later, which is the vendor-confirmed fix per the Apache advisory (https://dolphinscheduler.apache.org) and oss-security disclosure (https://seclists.org/oss-sec/2026/q2/958). If immediate upgrade is operationally infeasible, a targeted compensating control is to audit and restrict the pool of accounts granted system login privileges - reducing the number of users who could exploit the flaw. Additionally, administrators can implement network-layer access controls (e.g., firewall or reverse-proxy rules) to restrict API access to the DolphinScheduler API module to trusted internal networks or specific user segments, limiting exposure surface. Note that restricting login access may affect legitimate workflow users and should be coordinated with application owners. No further workarounds were documented in the available intelligence; upgrade to 3.4.2 remains the only confirmed remediation.